Why doesn't Splunk App for AWS show policy action logs for S3?

[randalthor80]

A coworker of mine was applying some policy changes to S3, and something went wrong. When he wanted to look at what happened, specifically the logs for S3 in splunk, he noticed that they weren't there.

Doesn't Cloudtrail store policy actions like that? If so, doesn't Splunk do it's magic with them?

[randalthor80 · Accepted solution]

You know, it helps if I were to read what AWS Cloutrail supports. As of now, it doesn't support S3 policies.